The Agent Skills Directory

[DYNAMIC_EXECUTION]: The skill uses a Jinja-style template engine to dynamically resolve parameters within prompt and command templates at runtime.
The /recipe run command interpolates user-supplied values from CLI arguments (--param), environment variables (RECIPE_<KEY>), and interactive prompts into strings that are subsequently executed or sent to the LLM.
The use of dynamic paths (e.g., ~/.claude/recipes/<domain>/<name>.yaml) to load execution logic introduces risks associated with loading content from potentially untrusted or attacker-controlled locations.
[COMMAND_EXECUTION]: The workflow system is designed to trigger arbitrary command-line tools as defined in the requires.cli_tools and prompt sections of a recipe.
The skill documentation explicitly lists execution of tools like trivy, gitleaks, and semgrep as primary functionality.
The execution flow involves routing instructions to agents that can perform these system operations based on the YAML definitions.
[INDIRECT_PROMPT_INJECTION]: The skill's architecture is susceptible to indirect prompt injection due to its heavy reliance on external data to form agent instructions.
Ingestion points: YAML recipe files stored in ~/.claude/recipes/, command-line arguments, and environment variables (SKILL.md).
Boundary markers: The instructions lack robust, structured boundary markers to separate user data from system instructions, relying instead on a general instruction to "sanitize" (SKILL.md).
Capability inventory: The skill possesses capabilities for filesystem access, execution of third-party CLI tools, and invocation of other skills (SKILL.md).
Sanitization: While "Template safety" is listed as an execution rule, the specific logic for filtering or escaping malicious inputs within the Jinja-style templates is not defined (SKILL.md).

recipe